fedora-selinux / selinux-policy

selinux-policy for Fedora is a large patch off the mainline
GNU General Public License v2.0
156 stars 157 forks source link

Allow init to delete daemorundir #2133

Open AlessandroBono opened 1 month ago

AlessandroBono commented 1 month ago

When a service specifies a runtime directory in its systemd service file with the RuntimeDirectory= property, systemd will take care of creating and deleting it.

From the docs[1]: "In case of RuntimeDirectory= the innermost subdirectories are removed when the unit is stopped.".

Allow init to delete such directories, otherwise the following definition is not enough:

type foo_var_run_t;
files_base_file(foo_var_run_t)
init_daemon_run_dir(foo_var_run_t, "foo")

Right now there are no issues because management permissions are granted to init via files_pid_file(foo_var_run_t) which is commonly used.

[1] https://www.freedesktop.org/software/systemd/man/255/systemd.exec.html#RuntimeDirectory=